{"url":"https://example.com","grade":"F","score":0,"checks":[{"header":"HSTS","present":false,"value":null,"points":0,"max_points":20,"advice":"Add Strict-Transport-Security to force HTTPS and prevent downgrade attacks."},{"header":"Content-Security-Policy","present":false,"value":null,"points":0,"max_points":25,"advice":"Add a Content-Security-Policy to mitigate XSS and data injection attacks."},{"header":"X-Content-Type-Options","present":false,"value":null,"points":0,"max_points":10,"advice":"Add X-Content-Type-Options: nosniff to prevent MIME-sniffing attacks."},{"header":"X-Frame-Options","present":false,"value":null,"points":0,"max_points":15,"advice":"Add X-Frame-Options (or frame-ancestors in CSP) to prevent clickjacking."},{"header":"Referrer-Policy","present":false,"value":null,"points":0,"max_points":10,"advice":"Add a Referrer-Policy to control how much referrer data leaks to other sites."},{"header":"Permissions-Policy","present":false,"value":null,"points":0,"max_points":10,"advice":"Add a Permissions-Policy to restrict access to browser features (camera, geolocation, etc.)."},{"header":"X-XSS-Protection","present":false,"value":null,"points":0,"max_points":5,"advice":"Legacy header, low impact on modern browsers, but cheap to add."},{"header":"Cross-Origin-Opener-Policy","present":false,"value":null,"points":0,"max_points":5,"advice":"Add Cross-Origin-Opener-Policy to isolate your browsing context from cross-origin windows."}]}